CVEs published October 18, 2026
552 CVEs were published on October 18, 2026: 10 critical, 55 high.
- Published
- 552
- Critical
- 10
- High
- 55
- Medium
- 81
- Low
- 5
- Unrated
- 401
- Now in CISA KEV
- 0
- Fix available
- 488
Most affected products
- Linux
- 435
- Gitea
- 12
- itsmeravitejak Online-Examination-System
- 5
- AUTOMATIC1111 stable-diffusion-webui
- 4
- light0011 cms
- 4
- Salon Booking System
- 4
- ProjectSend
- 3
- True Audio libtta
- 3
- vanus-labs vanus
- 3
- AI Engine
- 2
Critical 10
- CVE-2024-4457Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code ExecutionWSO2 Enterprise Integrator · WSO2 API Manager +5
- CVE-2026-98549tcp: prevent collapsing skbs across boundary in rtx queueLinux
- CVE-2026-98548sctp: discard the rest of the packet on a stale-cookie errorLinux
- CVE-2026-98490net: openvswitch: conntrack: fix helper UAF due to extensions reallocLinux
- CVE-2026-98464RISC-V: KVM: Synchronize hrtimer callback during teardownLinux
- CVE-2026-112005WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editorclidey whodb
- CVE-2026-111998Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gatewayvanus-labs vanus
- CVE-2026-110886WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerabilityQuantumCloud Conversational Forms for ChatBot
- CVE-2026-109894WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerabilityArraytics Booktics
- CVE-2026-110372WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerabilityBrainstorm Force OttoKit
High 55
- CVE-2026-107618Gitea cross-site request forgery on repository topicsGitea
- CVE-2026-109553Gitea SSH certificate principal impersonation of other usersGitea
- CVE-2026-98555llc: fix skb UAF and leaks on llc_mac_hdr_init() failureLinux
- CVE-2026-98550tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflowLinux
- CVE-2026-98543bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdirLinux
- CVE-2026-98532ipv6: do not let ipv6_find_hdr() return an offset past the packet endLinux
- CVE-2026-98524rds: ib: Clear the sg list when mapping an MR failsLinux
- CVE-2026-98520drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mappingLinux
- CVE-2026-98518drm/nouveau/dmem: pin VRAM for the whole registered rangeLinux
- CVE-2026-98517drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEMLinux
- CVE-2026-98515drm/nouveau: fix double-free in nvif_vmm_dtorLinux
- CVE-2026-98512drm/nouveau: RCU-free the scheduler-containing nouveau_schedLinux
- CVE-2026-98510drm/xe/vm: nuke PTs only after unlinking contested VMAsLinux
- CVE-2026-98507mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publishLinux
- CVE-2026-98501HID: alps: fix use-after-free on input2 registration failureLinux
- CVE-2026-98499HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()Linux
- CVE-2026-98497net/mlx5e: fix swapped IPv6 IPsec policy masksLinux
- CVE-2026-98491net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entryLinux
- CVE-2026-98487net: bridge: mdb: restart port group walk after deletionLinux
- CVE-2026-98485netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds readLinux
- CVE-2026-98479scsi: libiscsi_tcp: Check the data direction of a Data-In PDULinux
- CVE-2026-98471KVM: SEV: Do cache maintenance on the source VM during intra-host migrationLinux
- CVE-2026-98469KVM: arm64: Fix AArch32 DBGBXVR<n> handlingLinux
- CVE-2026-98466KVM: arm64: Transfer the hyp stack pages out of the host stage-2Linux
- CVE-2026-98465RISC-V: KVM: Serialize IMSIC attributes with vCPU migrationLinux
- CVE-2026-98456Bluetooth: mgmt: fix race in read_unconf_index_list()Linux
- CVE-2026-98454smb: client: fix create context out-of-bounds readsLinux
- CVE-2026-98451smb: client: use finish_no_open() for non-regular inodesLinux
- CVE-2026-98443xfs: fix cursor and pointer handling when recovering iunlink bucketsLinux
- CVE-2026-98442net/sched: act_ct: fix helper UAF due to extensions reallocLinux
- CVE-2026-98441net/sched: act_ct: avoid modifying shared unconfirmed ct entryLinux
- CVE-2026-98440KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destructionLinux
- CVE-2026-98436accel/amdxdna: Disable device buffer exportingLinux
- CVE-2026-112051Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registrationxorbitsai inference
- CVE-2026-112021snac2 before 2.93 Heap-Based Buffer Overflow via JSON Parser _xs_json_load_lexer()grunfink snac2
- CVE-2026-112018cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()jkuhlmann cgltf
- CVE-2026-112017JeecgBoot before 3.9.5 SQL Injection via SqlInjectionUtil Newline BypassJeecgBoot
- CVE-2026-112015Omnigent 0.3.0 before 0.14.0 Path Traversal via Sub-Agent os_env.cwdomnigent-ai omnigent
- CVE-2026-112006OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validationopentelemetry-exporter-otlp-proto-http
- CVE-2026-112002ProjectSend 2.5.0 before 2.7.0 Unverified Password Change via /settings/passwordProjectSend
- CVE-2026-112001ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token AbilitiesProjectSend
- CVE-2026-112000Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCsvanus-labs vanus
- CVE-2026-111999Vanus 0.8.0 through 0.9.0 Missing Authentication via Gateway CloudEvents HTTP Receivervanus-labs vanus
- CVE-2026-78497JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string evalJQ-Lite
- CVE-2026-110895WordPress Support Genix plugin <= 1.4.54 - SQL Injection vulnerabilityDevItems Support Genix
- CVE-2026-107436WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerabilityWP Chill Strong Testimonials
- CVE-2026-110373WordPress Login with phone number plugin <= 1.8.77 - Privilege Escalation vulnerabilityHamid Alinia Login with phone number
- CVE-2026-109895WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerabilityArraytics Booktics
- CVE-2026-110383WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerabilityWP E-Signature Electronic Signature Add-on for Fluent Forms
- CVE-2026-110897WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack Lite for Beaver Builder
- CVE-2026-110382WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerabilityNSquared Simply Schedule Appointments
- CVE-2026-108485WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerabilityThemeGrill eStore
- CVE-2026-96534Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_fes_csv_exportModern Events Calendar Lite · Modern Event Calendar Pro
- CVE-2026-110981WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' ParameterWP Photo Album Plus
- CVE-2026-110031Salon Booking System 10.17 - 10.31.10 - Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta KeySalon Booking System
Medium, low and unrated 487
- CVE-2026-112032aircheng-org iWebShop-5 util.php search sql injectionaircheng-org iWebShop-5
- CVE-2026-112031Chamilo LMS Ticket TicketManager.php addProject cross site scriptingChamilo LMS
- CVE-2026-112030diem-project diem dmDataLoad.php default passworddiem-project diem
- CVE-2026-112112An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matchinic BIRD
- CVE-2026-112029diem-project diem SHA1 PluginDmUser.class.php weak password hashdiem-project diem
- CVE-2026-112028light0011 cms Vote VoteController.class.php logic errorlight0011 cms
- CVE-2026-112111The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode.Bootstrap Shortcodes project Bootstrap Shortcodes
- CVE-2026-112027light0011 cms Uploadify check-exists.php file_exists file information disclosurelight0011 cms
- CVE-2026-112026light0011 cms UserModel.class.php sha1 weak password hashlight0011 cms
- CVE-2026-112025light0011 cms Captcha Validation UserController.class.php access controllight0011 cms
- CVE-2026-97859Gitea API disclosure of private user social graph, keys and starsGitea
- CVE-2026-97204Gitea label deletion across repository and organization IDsGitea
- CVE-2026-110494Gitea release attachment re-linking of issue attachmentsGitea
- CVE-2026-110324Gitea private profile information disclosure through POST requestGitea
- CVE-2026-110311Gitea draft release creation disclosing attachment metadataGitea
- CVE-2026-109844Gitea watched repositories API disclosure after access revocationGitea
- CVE-2026-107686Gitea reactions accepted on locked issues and commentsGitea
- CVE-2026-105964Gitea Actions artifact v4 API unbounded request bodyGitea
- CVE-2026-105661Gitea panic on the repositories route of individual usersGitea
- CVE-2026-104627Gitea OpenID account linking without session bindingGitea
- CVE-2026-111993Soarkey StudentManagement AdminDao.java UserDao.login cleartext storageSoarkey StudentManagement
- CVE-2026-111992itsmeravitejak Online-Examination-System Exam exam.php startExam sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-98868dm-pcache: reject a kset that overruns its segmentLinux
- CVE-2026-98867dm-pcache: bound the logical key offset from persistent memoryLinux
- CVE-2026-98866sched/cache: Introduce task_struct->sched_cache_grp to fix UAFLinux
- CVE-2026-98865sched_ext: Don't run ops.dequeue() with a DSQ lock heldLinux
- CVE-2026-98864sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing a taskLinux
- CVE-2026-98863KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages failsLinux
- CVE-2026-98862audit: fix exe mark UAF in kill_rules()Linux
- CVE-2026-98861fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()Linux
- CVE-2026-98860HID: bpf: cast size to ssize_t when checking hid_bpf_hw_requestLinux
- CVE-2026-98859HID: multitouch: stop the release timer from being rearmed on removeLinux
- CVE-2026-98858io_uring: fix task_work add use-after-free with SQPOLLLinux
- CVE-2026-98857ipvs: bound LBLCR and LBLC cache growthLinux
- CVE-2026-98856kprobes: Skip disarmed probes when checking optkprobe overlapLinux
- CVE-2026-98855of/overlay: put property on deadprops only after changeset add succeedsLinux
- CVE-2026-98854of/overlay: only treat a positive changeset id as registeredLinux
- CVE-2026-98853net: gso: limit recursive IP-in-IP segmentationLinux
- CVE-2026-98852net: extend IPv6 exthdr detection of tunneled packetsLinux
- CVE-2026-98851netfilter: nft_flow_offload: drop flowtable reference on init error pathLinux
- CVE-2026-98850net/packet: prevent TX_RING byte count overflowLinux
- CVE-2026-98849pfcp: fix socket lifetime on netdevice registration failureLinux
- CVE-2026-98848rtc: ac100: Assign .num before accessing .hwsLinux
- CVE-2026-98847rtc: spear: initialize IRQ state before requesting alarm IRQLinux
- CVE-2026-98846sctp: check RCV_SHUTDOWN after the sendmsg connect waitLinux
- CVE-2026-98845tpm: Disable TPM on null key name mismatchLinux
- CVE-2026-98844netfs: clear post-EOF pagecache when extending a file via writeLinux
- CVE-2026-98843netfs: zero gaps in read-gaps folio to avoid writing back stale dataLinux
- CVE-2026-98842module: fix lost error code from codetag_load_module()Linux
- CVE-2026-98841virt: vmgenid: set driver_data before registering notification handlersLinux
- CVE-2026-98840vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAFLinux
- CVE-2026-98839vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()Linux
- CVE-2026-98838vt: skip screen update for DEC alignment test on backgroup consolesLinux
- CVE-2026-98837ALSA: caiaq: unregister the input device when probe failsLinux
- CVE-2026-98836ALSA: line6: reject oversized playback packetsLinux
- CVE-2026-98835iio: accel: kionix-kx022a: Fix array boundary checkLinux
- CVE-2026-98834mtd: core: avoid double-free of OTP NVMEM deviceLinux
- CVE-2026-98833mtd: core: call _get_device() with the master MTDLinux
- CVE-2026-98832blk-cgroup: save IRQ state in blkg_tryget_closest()Linux
- CVE-2026-98831of/overlay: don't leak fragment references when changeset init failsLinux
- CVE-2026-98830wifi: wfx: validate MIB read length before copying to callerLinux
- CVE-2026-98829wifi: mac80211: drop oversized fragments to avoid extra_len overflowLinux
- CVE-2026-98828wifi: ath9k: reject short WMI command responsesLinux
- CVE-2026-98827wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZELinux
- CVE-2026-98826rtc: ac100: Fix clock provider use-after-free on probe failureLinux
- CVE-2026-98825rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()Linux
- CVE-2026-98824wifi: mac80211: validate TX status rate metadataLinux
- CVE-2026-98823wifi: cfg80211: preserve hidden-group beacon IE ownershipLinux
- CVE-2026-98822wifi: mac80211: prevent AP VLAN tx from other interfacesLinux
- CVE-2026-98821block: reject polled dio with user integrity metadataLinux
- CVE-2026-98820blk-mq: set RQF_USE_SCHED when the operation is knownLinux
- CVE-2026-98819Bluetooth: btintel: validate DDC record lengthsLinux
- CVE-2026-98818mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()Linux
- CVE-2026-98817ASoC: SDCA: Add better pm_runtime error handling in func probeLinux
- CVE-2026-98816bpf: Fix overflow of jump offset in constant blindingLinux
- CVE-2026-98815nvme: fix cdev lifetimeLinux
- CVE-2026-98814nvme: fix command effects log lifetime for multipath headsLinux
- CVE-2026-98813bpf: Hold map BTF for the memory allocator destructor recordLinux
- CVE-2026-98812net/mctp: publish the mctp_dev only after it is initialisedLinux
- CVE-2026-98811net/sched: cls_api: reclaim an empty proto on the error pathLinux
- CVE-2026-98810wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()Linux
- CVE-2026-98809Bluetooth: hci_sync: don't drain cmd_sync backlog on unregisterLinux
- CVE-2026-98808net: systemport: Fix buffer overflow in bcm_sysport_get_stats()Linux
- CVE-2026-98807net/mlx5: Fix slab-out-of-bounds when handling team device eventsLinux
- CVE-2026-98806octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabledLinux
- CVE-2026-98805tipc: prevent GCM nonce reuse on peer key changesLinux
- CVE-2026-98804net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()Linux
- CVE-2026-98803net: stmmac: fix rx Scatter-Gather supportLinux
- CVE-2026-98802seg6: ensure packet data is writable before modifying SRH and IPv6 DALinux
- CVE-2026-98801net: restrict SO_RESERVE_MEM to TCP sockets and cap max valueLinux
- CVE-2026-98800bpf: Wait for an RCU tasks grace period before freeing trampoline progsLinux
- CVE-2026-98799bpf: Skip detached progs in trampoline images that are still in useLinux
- CVE-2026-98798net: bcmgenet: fix NULL dereference in set_coalesce before first openLinux
- CVE-2026-98797net: cap skb->queue_mapping when the tx queue is pickedLinux
- CVE-2026-98796net: ethernet: mtk_eth_soc: allocate dummy netdev soonerLinux
- CVE-2026-98795net: sparx5: skip ptp deinit if init was skippedLinux
- CVE-2026-98794ipvs: filter some flags received in the backup serverLinux
- CVE-2026-98793netfilter: bpf: reject invalid NAT manipulation typesLinux
- CVE-2026-98792netfilter: flowtable: generalize pending status bitLinux
- CVE-2026-98791net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereferenceLinux
- CVE-2026-98790perf: Fix race between perf_event_exit_task() and perf_pending_task()Linux
- CVE-2026-98789bpf: Fix objects stuck in free_by_rcu_ttraceLinux
- CVE-2026-98788futex: Fix private hash use-after-free on resizeLinux
- CVE-2026-98787bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()Linux
- CVE-2026-98786drm/amd/display: guard dc_sink dereferences in MST mode validationLinux
- CVE-2026-98785drm/amd/display: check dc_state_create_copy() for NULL in dm_suspendLinux
- CVE-2026-98784drm/amdgpu/gfx6: fix firmware leak on teardownLinux
- CVE-2026-98783drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform deviceLinux
- CVE-2026-98782drm/mediatek: Fix ovl adaptor platform device leakLinux
- CVE-2026-98781drm/mediatek: Fix pdev reference leak in mtk_drm_bind()Linux
- CVE-2026-98780drm/amdgpu: fix IP instance memory leak on kobject add failureLinux
- CVE-2026-98779drm/amdgpu: fix ACP MFD device leak on init failureLinux
- CVE-2026-98778binder: fix is_failure flag for superseded transaction cleanupLinux
- CVE-2026-98777binder: fix leaked fd fixups on TF_UPDATE_TXN supersedeLinux
- CVE-2026-98776binderfs: fix UAF write in binder_add_deviceLinux
- CVE-2026-98775nitro_enclaves: fix use-after-free on SLOT_ALLOC failureLinux
- CVE-2026-98774rust_binder: cancel deferred work items in thread exitLinux
- CVE-2026-98773USB: cdc-acm: skip URB restart in port_shutdown if disconnectedLinux
- CVE-2026-98772USB: serial: fix port tear down use-after-freeLinux
- CVE-2026-98771usb: storage: sierra_ms: reject short SWoC info transfersLinux
- CVE-2026-98770usb: gadget: midi2: Fix the jack descriptor array sizesLinux
- CVE-2026-98769usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmdLinux
- CVE-2026-98768usb: typec: anx7411 - stop the IRQ before destroying the workqueueLinux
- CVE-2026-98767usb: dwc3: gadget: fix IRQ storm on invalid event buffer countLinux
- CVE-2026-98766usb: gadget: aspeed-vhub: cancel wake work on device removalLinux
- CVE-2026-98765USB: gadget: dummy-hcd: Fix wait for outstanding request completionsLinux
- CVE-2026-98764usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESCLinux
- CVE-2026-98763usb: core: clear both ep_in and ep_out for non-ep0 control endpointsLinux
- CVE-2026-98762USB: dwc2: shut down wakeup timer before freeing HCD stateLinux
- CVE-2026-98761usb: typec: tcpm: recover after failure to start the frs amsLinux
- CVE-2026-98760usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()Linux
- CVE-2026-98759usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()Linux
- CVE-2026-98758usb: typec: ucsi: glink: fix use-after-free of ucsi on removeLinux
- CVE-2026-98757usb: cdns3: fix use-after-free in cdns3_gadget_exit()Linux
- CVE-2026-98756usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probeLinux
- CVE-2026-98755tty: vcc: zero-initialize control packet in vcc_send_ctl()Linux
- CVE-2026-98754tty: vcc: hold port lock when clearing tty pointer in vcc_cleanupLinux
- CVE-2026-98753tty: tty_port: restore TTY_IO_ERROR on activation failureLinux
- CVE-2026-98752tty: port: fix tty_port_tty_vhangup() raceLinux
- CVE-2026-98751tty: abort break signalling on hangupLinux
- CVE-2026-98750tty: fix saved termios reset raceLinux
- CVE-2026-98749tty: serial: max3100: shut down timer before freeing portLinux
- CVE-2026-98748serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()Linux
- CVE-2026-98747serial: core: fix NULL pointer dereference in serial_core_unregister_port()Linux
- CVE-2026-98746serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()Linux
- CVE-2026-98745arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systemsLinux
- CVE-2026-98744ASoC: codecs: max98363: fix uninitialized stream_config->typeLinux
- CVE-2026-98743ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->typeLinux
- CVE-2026-98742ALSA: seq: Serialize compat port-info ioctlsLinux
- CVE-2026-98741ALSA: ua101: reject mismatched capture/playback packet sizesLinux
- CVE-2026-98740EDAC/altera: Drop __init from ECC setup paths for re-probe safetyLinux
- CVE-2026-98739Bluetooth: RFCOMM: Fix initial port reference raceLinux
- CVE-2026-98738Bluetooth: Serialize SMP remote OOB data accessLinux
- CVE-2026-98737Bluetooth: hci_sync: Fix inquiry cache use-after-freeLinux
- CVE-2026-98736Bluetooth: hci_conn: Lock parent access during enhanced SCO setupLinux
- CVE-2026-98735Bluetooth: hci_core: Serialize ACL scheduling with channel deletionLinux
- CVE-2026-98734Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardownLinux
- CVE-2026-98733Bluetooth: hci_core: Serialize fragmented ISO packet queueingLinux
- CVE-2026-98732Bluetooth: btintel: fix buffer over-read in btintel_hw_error()Linux
- CVE-2026-98731Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()Linux
- CVE-2026-98730Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()Linux
- CVE-2026-98729x86/mm: Don't apply va_align to hugetlb mappings on AMD F15hLinux
- CVE-2026-98728tpm: fix off-by-four bounds check in tpm2_get_random()Linux
- CVE-2026-98727nvme-multipath: set BLK_FEAT_ZONED only after the zone info is knownLinux
- CVE-2026-98726nvme-multipath: fix underflow in ANA log bounds checksLinux
- CVE-2026-98725nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()Linux
- CVE-2026-98724nvmet: pci-epf: reject too-short SGL segmentsLinux
- CVE-2026-98723nvmet: copy the hostid into the ctrl before creating PR pc_refsLinux
- CVE-2026-98722mtd: block2mtd: Fix divide error when erase_size is zeroLinux
- CVE-2026-98721mtd: rawnand: cadence: Initialize IRQ state before requesting IRQLinux
- CVE-2026-98720KVM: nVMX: Force MSR bitmap refresh if runtime eVMCS controls are modifiedLinux
- CVE-2026-98719KVM: SEV: Nullify "have run CPUs" mask pointer when freeing itLinux
- CVE-2026-98718KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV stateLinux
- CVE-2026-98717KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummyLinux
- CVE-2026-98716KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is interceptedLinux
- CVE-2026-98715KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUNLinux
- CVE-2026-98714KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeededLinux
- CVE-2026-98713KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGTLinux
- CVE-2026-98712KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irqLinux
- CVE-2026-98711wifi: cw1200: fix TX padding OOB read leaking heap data to deviceLinux
- CVE-2026-98710wifi: iwlegacy: 3945: free EEPROM data on removeLinux
- CVE-2026-98709wifi: mac80211: count only matching reservations in reserved switchLinux
- CVE-2026-98708wifi: mac80211: keep paired old chanctx aliveLinux
- CVE-2026-98707wifi: mac80211: shut down RX BA session timer on teardownLinux
- CVE-2026-98706wifi: mac80211: drain PS delivery work during station teardownLinux
- CVE-2026-98705wifi: mac80211: account proxy paths against the mesh path limitLinux
- CVE-2026-98704wifi: mac80211: keep fallback association elements aliveLinux
- CVE-2026-98703wifi: mac80211: minstrel_ht: validate fixed rate indexLinux
- CVE-2026-98702wifi: mac80211: reject invalid 320 MHz CSA bandwidthLinux
- CVE-2026-98701wifi: mac80211: release mesh path quota on failed additionsLinux
- CVE-2026-98700wifi: mac80211: set info->band for 802.3 encap offload framesLinux
- CVE-2026-98699wifi: mac80211: fix mesh fast xmit path deletion UAFLinux
- CVE-2026-98698wifi: mac80211: handle empty FILS association request payloadLinux
- CVE-2026-98697USB: serial: fix dynamic id driver deregistration raceLinux
- CVE-2026-98696USB: serial: fix driver deregistration orderLinux
- CVE-2026-98695USB: serial: fix ioctl hangup raceLinux
- CVE-2026-98694thunderbolt: Fix KASAN reported use-after-free when request is canceledLinux
- CVE-2026-98693thunderbolt: Hold a router reference for each allocated HopIDLinux
- CVE-2026-98692thunderbolt: Make the DP tunnel activation callback mandatoryLinux
- CVE-2026-98691thunderbolt: Tear down inactive DP tunnels when the domain is stoppedLinux
- CVE-2026-98690thunderbolt: Fix domain reference leak when DPRX read is canceledLinux
- CVE-2026-98689thunderbolt: Don't access a DP tunnel after its DPRX read was canceledLinux
- CVE-2026-98688thunderbolt: Fix NULL dereference in tb_remove_work()Linux
- CVE-2026-98687thunderbolt: Reject oversized XDomain properties responsesLinux
- CVE-2026-98686smb: client: discard post-EOF pagecache when extending a file via zero rangeLinux
- CVE-2026-98685smb: client: discard post-EOF pagecache when extending a file via clone rangeLinux
- CVE-2026-98684smb: client: flush and commit data before querying allocated rangesLinux
- CVE-2026-98683smb: client: flush dirty data before zeroing a rangeLinux
- CVE-2026-98682smb: client: drain and invalidate before server-side copy/cloneLinux
- CVE-2026-98681smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW racesLinux
- CVE-2026-98680iio: accel: kionix-kx022a: Prevent memory leak and fix stateLinux
- CVE-2026-98679iio: accel: kxcjk-1013: reject duplicate event disableLinux
- CVE-2026-98678iio: adc: ad4030: fix invalid oversampling_ratio validationLinux
- CVE-2026-98677iio: adc: ad_sigma_delta: fix use-after-free on unbindLinux
- CVE-2026-98676iio: adc: ade9000: fix NULL pointer dereference in clkout registrationLinux
- CVE-2026-98675iio: adc: ade9000: handle Phase C dip events in IRQ1 handlerLinux
- CVE-2026-98674iio: adc: adi-axi-adc: Initialize state mutexLinux
- CVE-2026-98673iio: adc: pac1934: check ACPI label duplicationLinux
- CVE-2026-98672iio: adc: stm32-adc: fix possible division by zero in processed channelLinux
- CVE-2026-98671iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failureLinux
- CVE-2026-98670iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbindLinux
- CVE-2026-98669iio: buffer: serialize buffer teardown with mode claimsLinux
- CVE-2026-98668iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.Linux
- CVE-2026-98667iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_dataLinux
- CVE-2026-98666iio: gyro: adis16136: fix unprotected debugfs readsLinux
- CVE-2026-98665iio: health: max30102: fix NULL dereference in interrupt handlerLinux
- CVE-2026-98664iio: imu: adis16400: fix unprotected debugfs readsLinux
- CVE-2026-98663iio: imu: adis16480: fix unprotected debugfs readsLinux
- CVE-2026-98662iio: light: gp2ap020a00f: drain irq_work after free_irqLinux
- CVE-2026-98661iio: light: rohm-bu27034: Fix infinite delay on errorLinux
- CVE-2026-98660iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookupLinux
- CVE-2026-98659iio: pressure: rohm-bm1390: Return error when read failsLinux
- CVE-2026-98658iio: proximity: aw96103: validate firmware data lengthLinux
- CVE-2026-98657iio: proximity: pulsedlight: fix iio_device left registered on PM setup failureLinux
- CVE-2026-98656iio: trigger: cancel reenable_work before freeing triggerLinux
- CVE-2026-98655perf: Require kernel access for text poke eventsLinux
- CVE-2026-98653KVM: s390: Fix _gaccess_shadow_fault()Linux
- CVE-2026-98652KVM: s390: Add missing srcu in kvm_s390_set_irq_state()Linux
- CVE-2026-98651KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()Linux
- CVE-2026-98650KVM: s390: Fix potential races in dat skey functionsLinux
- CVE-2026-98649KVM: s390: Fix race in _destroy_pages_crste()Linux
- CVE-2026-98648s390/uv: Prevent potential out-of-bounds readLinux
- CVE-2026-98647bpf: Fix divide-by-zero in btf_struct_walk()Linux
- CVE-2026-98646tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF contextLinux
- CVE-2026-98645HID: winwing: fix use-after-free in force feedback teardownLinux
- CVE-2026-98644bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()Linux
- CVE-2026-98643bpf: Fix out-of-bounds read of rtt_min in sock_opsLinux
- CVE-2026-98642bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulkLinux
- CVE-2026-98641bpf, arm64: set up the frame pointer for the exception callbackLinux
- CVE-2026-98640HID: amd_sfh: Validate PCI BAR size before mappingLinux
- CVE-2026-98639KVM: riscv: Fix NACL hfence entry update orderLinux
- CVE-2026-98638KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()Linux
- CVE-2026-98637KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failureLinux
- CVE-2026-98636squashfs: Add dictionary size range check to prevent shift-out-of-boundsLinux
- CVE-2026-98635scsi: block: Fix zones_cond out-of-bounds write on zone reportLinux
- CVE-2026-98634scsi: sd_zbc: Reject disks with too many zonesLinux
- CVE-2026-98633Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()Linux
- CVE-2026-98632Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancelLinux
- CVE-2026-98631xsk: Use a 32-bit compare in xsk_map_gen_lookupLinux
- CVE-2026-98630eth: fbnic: Fix payload page pool error cleanupLinux
- CVE-2026-98629net/sched: cls_u32: fix manual hash table handle IDR aliasingLinux
- CVE-2026-98628bpf: Make post-verification instruction rewrites killableLinux
- CVE-2026-98627bpf: Preserve packet pointer class displacement in regsafe()Linux
- CVE-2026-98626bpf: Restrict CO-RE poisoning to relocatable instructionsLinux
- CVE-2026-98625netfilter: flowtable: publish HW_DEAD after worker is doneLinux
- CVE-2026-98624netfilter: nfnetlink_queue: hold nfnl mutex in event notifierLinux
- CVE-2026-98623drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_updateLinux
- CVE-2026-98622net/sched: act_ct: don't WARN on benign flow_offload_alloc() failureLinux
- CVE-2026-98621net: gue: reject invalid REMCSUM offsetsLinux
- CVE-2026-98620net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failureLinux
- CVE-2026-98619net: ethtool: keep rtnl_lock for the ioctl self testLinux
- CVE-2026-98618eth: fbnic: Handle maximum standalone channelsLinux
- CVE-2026-98617eth: fbnic: use the Rx queue napi pointer to find the napi vectorLinux
- CVE-2026-98616eth: fbnic: reset num_napi when the napi vectors are freedLinux
- CVE-2026-98615eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailboxLinux
- CVE-2026-98614sctp: avoid livelock while updating retransmit pathLinux
- CVE-2026-98613bpf: Bound ownership depth through local kptrs and graph rootsLinux
- CVE-2026-98612net: usb: catc: bound the RX packet length in catc_rx_done()Linux
- CVE-2026-98611bpf: Check params size before reading reserved fieldsLinux
- CVE-2026-98610net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budgetLinux
- CVE-2026-98609drm/virtio: fix object leak when drm_gem_handle_create() failsLinux
- CVE-2026-98608drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()Linux
- CVE-2026-98607drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()Linux
- CVE-2026-98606drm/virtio: release the GEM object on virtio_gpu_vram_create() errorsLinux
- CVE-2026-98605drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attachLinux
- CVE-2026-98604ovpn: replace bind when learning local endpointLinux
- CVE-2026-98603ovpn: replace bind when clearing stale local sourceLinux
- CVE-2026-98602Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthroughLinux
- CVE-2026-98601Bluetooth: btintel_pcie: validate device-supplied DMA indicesLinux
- CVE-2026-98600Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()Linux
- CVE-2026-98599bpf: Reject non-negative offsets in stack_slot_obj_get_spi()Linux
- CVE-2026-98598ipv6: Prevent rt6_insert_exception() for dying fib6_info.Linux
- CVE-2026-98597net: usb: sr9700: include receive overhead in the length checkLinux
- CVE-2026-98596ipv6: Fix dst leak for uncached routes.Linux
- CVE-2026-98595udp: remove a disconnected socket from the 4-tuple hash tableLinux
- CVE-2026-98594tg3: clean up PHYLIB resources on probe failureLinux
- CVE-2026-98593s390/debug: Fix NULL pointer dereference in debug_info_copy()Linux
- CVE-2026-98592net: spacemit: clear TX descriptor on fragment mapping failureLinux
- CVE-2026-98591bpf: Fix bounds check for skb-backed dynptrsLinux
- CVE-2026-98590bpf: Fix bpf_sock context code generationLinux
- CVE-2026-98589bpf: Reject pkt arguments in mutating subprogsLinux
- CVE-2026-98588bpf, sockmap: Reject max_entries > INT_MAX in sock_map_allocLinux
- CVE-2026-98587firewire: cdev: fix back-transition for iso_resource_auto client resourceLinux
- CVE-2026-98586sctp: hold asoc or transport before mod_timer() in timer handlersLinux
- CVE-2026-98585eth: fbnic: Avoid rounding zero ring sizesLinux
- CVE-2026-98584net/sched: fix potential stack infoleak in em_text_dump()Linux
- CVE-2026-98583nfc: nfcmrvl: validate helper command length before pullLinux
- CVE-2026-98582nfc: st21nfca: validate received frame sizeLinux
- CVE-2026-98581nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()Linux
- CVE-2026-98580nfc: llcp: Fix race condition in accept_queue lifecycleLinux
- CVE-2026-98579nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failureLinux
- CVE-2026-98578nfc: st21nfca: validate ISO15693 inventory lengthLinux
- CVE-2026-98577nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()Linux
- CVE-2026-98576nfc: llcp: fix slab-out-of-bounds reads when logging service namesLinux
- CVE-2026-98575nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()Linux
- CVE-2026-98574net: bcmgenet: stop Tx NAPI before disabling the queuesLinux
- CVE-2026-98573net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()Linux
- CVE-2026-98572bpf: Fix immediate JMP JEQ/JNE on MIPS32Linux
- CVE-2026-98571net: stmmac: clear stale buf->page after recycling on skb build failureLinux
- CVE-2026-98570net: ipv6: keep room for the mac header in dst_dev_overhead()Linux
- CVE-2026-98569ip_gre: Reject enabling collect metadata through changelinkLinux
- CVE-2026-98568vxlan: use one headroom snapshot for neighbour repliesLinux
- CVE-2026-98567net: xps: reject an out of range traffic classLinux
- CVE-2026-98566drm/imagination: clamp freelist reconstruction requestsLinux
- CVE-2026-98565net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621Linux
- CVE-2026-98564net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irqLinux
- CVE-2026-98563net: phylink: record the PHY only once bringup cannot failLinux
- CVE-2026-98562net: libwx: fix races in Tx timestamp handlingLinux
- CVE-2026-98561nfp: hold IPsec RX state under the XArray lockLinux
- CVE-2026-98560net/rds: size a connection's path set by the transport it ends up withLinux
- CVE-2026-98559net/smc: fix UAF on lgr list traversal in smcr_port_err()Linux
- CVE-2026-98558net: flush skb_defer_nodes in dev_cpu_dead()Linux
- CVE-2026-98557gve: DQO: fix header length used by gve_can_send_tso() for UDP GSOLinux
- CVE-2026-98556gve: DQO: reject TSO packets with an out of range MSSLinux
- CVE-2026-98554vlan: ensure sufficient headroom in vlan_dev_hard_header()Linux
- CVE-2026-98553autofs: fix sbi->pipe file reference leak in autofs_kill_sb()Linux
- CVE-2026-98552perf/core: Fix a refcount leak in attach_perf_ctx_data()Linux
- CVE-2026-98551perf/core: Fill branch entries with a single assignmentLinux
- CVE-2026-98547af_packet: fix integer overflow in prb_calc_retire_blk_tmo()Linux
- CVE-2026-98546arm64/boot: Disable trapping of PMZR_EL0 writes to EL2Linux
- CVE-2026-98545ata: libata-scsi: bound the ATA passthru sense descriptor writesLinux
- CVE-2026-98544bna: prevent IOC timer rearm during teardownLinux
- CVE-2026-98542cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflictLinux
- CVE-2026-98541fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECTLinux
- CVE-2026-98540fprobe: Terminate the fgraph_data list when the reservation is not filledLinux
- CVE-2026-98539fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" sagaLinux
- CVE-2026-98538writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodesLinux
- CVE-2026-98537workqueue: Fix NULL current_pwq deref in flush dependency checkLinux
- CVE-2026-98536writeback: report a Tasks-RCU quiescent state per cgwb drain passLinux
- CVE-2026-98535fsl/fman: Fix clk reference leak in read_dts_node()Linux
- CVE-2026-98534ipe: fix use-after-free when auditing a newly loaded policyLinux
- CVE-2026-98533ipe: protect the dm-verity root hash with RCULinux
- CVE-2026-98531ipv6: sr: enforce exact attribute length for SEG6_ATTR_DSTLinux
- CVE-2026-98530kprobes: Fix permanent hang when flushing the kprobe optimizerLinux
- CVE-2026-98529gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()Linux
- CVE-2026-98528gpio: cdev: fix kernel stack leak to user-space in error pathLinux
- CVE-2026-98527gpio: zynq: fix runtime PM leak on request error pathLinux
- CVE-2026-98526llc: reserve device headroom for allocated framesLinux
- CVE-2026-98525mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()Linux
- CVE-2026-98523drm/client: fix restore of partially initialized clientLinux
- CVE-2026-98522drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()Linux
- CVE-2026-98521drm/i915: fix incorrect RCU teardown orderLinux
- CVE-2026-98519drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()Linux
- CVE-2026-98516drm/nouveau: Fix bridge reference leak in nv1a_ram_new()Linux
- CVE-2026-98514drm/nouveau: Fix gem reference leak in validate_init()Linux
- CVE-2026-98513drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()Linux
- CVE-2026-98511drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()Linux
- CVE-2026-98509drm/virtio: fix memory leak of fence event on execbuffer failureLinux
- CVE-2026-98508drm/virtio: fix NULL pointer dereference on fence allocation failureLinux
- CVE-2026-98506mm/hugetlb: do not dissolve gigantic pages without runtime supportLinux
- CVE-2026-98505mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()Linux
- CVE-2026-98504PCI: of_property: Omit bus properties without a subordinate busLinux
- CVE-2026-98503packet: use ubuf_info completion for TX_RING packetsLinux
- CVE-2026-98502HID: alps: unregister DualPoint Stick input device on removeLinux
- CVE-2026-98500HID: hid-oxp: use cancel_delayed_work_sync() in removeLinux
- CVE-2026-98498net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()Linux
- CVE-2026-98496net: airoha: npu: cancel wdt_work after releasing the WDT IRQLinux
- CVE-2026-98495net: arp: terminate device name before lookupLinux
- CVE-2026-98494net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean readLinux
- CVE-2026-98493net: ipconfig: bound DHCP option constructionLinux
- CVE-2026-98492net: macb: fix dma_alloc_coherent() leak on macb_alloc() error pathsLinux
- CVE-2026-98489net: atl1c: fix soft lockup on out-of-range tpd_cons readLinux
- CVE-2026-98488net: atl1e: fix soft lockup on out-of-range hw_next_to_clean readLinux
- CVE-2026-98486net: ena: fix MMIO read buffer leak on probe failureLinux
- CVE-2026-98484netfilter: nf_tables: skip expired catchall elements on insert and deleteLinux
- CVE-2026-98483nfc: fix use-after-free in nfc_get_local_general_bytesLinux
- CVE-2026-98482nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()Linux
- CVE-2026-98481nfc: port100: reject frames whose declared length exceeds the received dataLinux
- CVE-2026-98480nfc: trf7970a: power down on startup RX gain failureLinux
- CVE-2026-98478scsi: ufs: core: Keep internal commands dispatchable during error handlingLinux
- CVE-2026-98477perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()Linux
- CVE-2026-98476s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()Linux
- CVE-2026-98475s390/cmf: Fix virtual vs physical address confusionLinux
- CVE-2026-98474s390/pci: Fix missing device lock in zpci_report_status()Linux
- CVE-2026-98473s390/vfio-ap: fix KVM GISC and page leak when queue removed from host configLinux
- CVE-2026-98472KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEVLinux
- CVE-2026-98470KVM: arm64: Don't WARN on an unknown VM ioctl in protected modeLinux
- CVE-2026-98468KVM: arm64: Fix spurious warning for benign stage 2 teardown raceLinux
- CVE-2026-98467KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown raceLinux
- CVE-2026-98463sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flagsLinux
- CVE-2026-98462Bluetooth: hci_conn: fix CIS hold ownership on reuseLinux
- CVE-2026-98461Bluetooth: hci_sock: validate event length before filteringLinux
- CVE-2026-98460Bluetooth: hci_sock: reject out-of-range OCF valuesLinux
- CVE-2026-98459Bluetooth: ISO: balance the parent hold in hci_bind_bis()Linux
- CVE-2026-98458Bluetooth: ISO: release unused CIS holds after channel attachLinux
- CVE-2026-98457Bluetooth: L2CAP: validate frame length before control and FCS accessLinux
- CVE-2026-98455Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFOLinux
- CVE-2026-98453smb: client: close handle after create-context parsing failureLinux
- CVE-2026-98452smb: client: clean up failed cached directory opensLinux
- CVE-2026-98450smb: client: close completed creates on compound wait errorsLinux
- CVE-2026-98449smb: client: delete compound mids on send failure before unlockLinux
- CVE-2026-98448xfs: release orphanage dir inode if chown failsLinux
- CVE-2026-98447xfs: fix wild memcpy access when formatting ondisk rtrefcount btree rootsLinux
- CVE-2026-98446xfs: don't let hidden_space go negative in xfs_metafile_resv_initLinux
- CVE-2026-98445xfs: don't let memory failures leak blocks and kill repairsLinux
- CVE-2026-98444xfs: drop dquot flush lock when we can't find a buffer to flushLinux
- CVE-2026-111991WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injectionWongKinYiu yolov9
- CVE-2026-98439smb/server: cancel async requests when closing connectionLinux
- CVE-2026-98438mptcp: options: fix uninit-value in mptcp_write_data_finLinux
- CVE-2026-98437media: qcom: iris: fix runtime PM reference leaksLinux
- CVE-2026-98435EDAC/altera: Use parent device for devres in altr_portb_setup()Linux
- CVE-2026-111990kishan0725 Hospital Management System Appointment Cancellation admin-panel.php mysqli_query sql injectionkishan0725 Hospital Management System
- CVE-2026-98434sysctl: Check range in proc_dointvec_ms_jiffies_minmaxLinux
- CVE-2026-98433KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failureLinux
- CVE-2026-110024@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults@fastify/jwt
- CVE-2026-111988dyad-sh dyad OAuth Callback cross-site request forgerydyad-sh dyad
- CVE-2026-111987AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scriptingAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-111986AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injectionAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-112063libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hilibstrophe
- CVE-2026-112062lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response HandlerlwIP
- CVE-2026-112061librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_DecodeRTMPDump librtmp
- CVE-2026-112060librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_DecodeRTMPDump librtmp
- CVE-2026-112059libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLRlibLAS
- CVE-2026-112058libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTTVideoLAN libdvdnav
- CVE-2026-112057libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chaptersVideoLAN libdvdnav
- CVE-2026-112056wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSHwvWare wv
- CVE-2026-112055wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKPwvWare wv
- CVE-2026-112054Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsingschroedinger
- CVE-2026-112053Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrixschroedinger
- CVE-2026-112052libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsinglibspatialite
- CVE-2026-112050Gitify before 7.10.0 Login CSRF via Missing OAuth State Validationgitify-app gitify
- CVE-2026-112049Vita3K before build 4187 Path Traversal via VPK Package InstallationVita3K
- CVE-2026-112048libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Countlibspatialite
- CVE-2026-112047OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actionsoneuptime
- CVE-2026-112046OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()OW2 ASM
- CVE-2026-111985AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resourcesAUTOMATIC1111 stable-diffusion-webui
- RUSTSEC-2026-0414Exponential event growth with `ENABLE_WIKILINKS`pulldown-cmark
- CVE-2026-111984AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scriptingAUTOMATIC1111 stable-diffusion-webui
- CVE-2026-112020LodePNG through 20261006 Heap Out-of-Bounds Read via getFilterTypesInterlaced()lvandeve lodepng
- CVE-2026-112019cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()jkuhlmann cgltf
- CVE-2026-112016Netcore NR256CN through 1.5.140116 Unauthenticated Write to Fixed Boa Staging FilesNetcore NR256CN
- CVE-2026-112014LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Exportnetease-youdao LobsterAI
- CVE-2026-112013libtta through 2.3 Divide by Zero via tta_decoder_init_get_infoTrue Audio libtta
- CVE-2026-112012libtta through 2.3 Stack Out-of-Bounds Write via Zero Channel CountTrue Audio libtta
- CVE-2026-112011libtta through 2.3 Integer Overflow via tta_decoder_init_get_info Seek TableTrue Audio libtta
- CVE-2026-112010smpeg through 2.0.0 Integer Underflow via stream_header in MPEGsystem.cppicculus smpeg
- CVE-2026-112009smpeg through 2.0.0 Heap Out-of-Bounds Read via MPEGsystem::FillBuffericculus smpeg
- CVE-2026-112008libmng through 2.0.3 Heap Buffer Overflow via ORDR Chunk Reader mng_read_ordrlibmng
- CVE-2026-112007Schism Tracker through 20260524 Heap Out-of-Bounds Write via ULT Loaderschismtracker Schism Tracker
- CVE-2026-112004Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpointteableio teable
- CVE-2026-112003ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteProjectSend
- CVE-2026-110880WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerabilityKit
- CVE-2026-110883WordPress 2Way VideoCalls and Random Chat plugin <= 6.1.5 - Broken Authentication vulnerabilityVideoWhisper.com 2Way VideoCalls and Random Chat
- CVE-2026-110885WordPress HivePress plugin <= 1.7.32 - Content Injection vulnerabilityHivePress
- CVE-2026-110365WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerabilityWPExperts Advanced File Manager
- CVE-2026-111942hrisikeshpal Blood_Bank_Management_System abs.php cross site scriptinghrisikeshpal Blood_Bank_Management_System
- CVE-2026-111041AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_mediaAI Engine
- CVE-2026-110976AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_mediaAI Engine
- CVE-2026-110070Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDORModern Events Calendar Lite
- CVE-2026-110069Modern Events Calendar Lite < 7.37.0 - Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX ActionsModern Events Calendar Lite
- CVE-2026-110035Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST RouteSalon Booking System
- CVE-2026-110033Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'Salon Booking System
- CVE-2026-110032Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer EditorSalon Booking System
- CVE-2026-110026Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and DeletionTasty Recipes Lite
- CVE-2026-109937Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout BlockOtter Blocks
- CVE-2026-87844Product Designer <= 1.0.40 - Unauthenticated Design Template Data InjectionPickPlugins Product Designer for WooCommerce
- CVE-2026-111877dext34-morgan Books4Cash search.php cross site scriptingdext34-morgan Books4Cash
- CVE-2026-111876alexpasmantier television entry.rs output command injectionalexpasmantier television
- CVE-2026-111875David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorizationDavid-Crty Databasement
- CVE-2026-111874OpenCATS Career Portal CareersUI.php processLogin excessive authenticationOpenCATS
- CVE-2026-111873itsmeravitejak Online-Examination-System AJAX Endpoint exammanger.php topicslist sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-111872itsmeravitejak Online-Examination-System database.php getreport sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-111871itsmeravitejak Online-Examination-System subjectsdb.php sql injectionitsmeravitejak Online-Examination-System
- CVE-2026-111870itsmeravitejak Online-Examination-System admin.php isAdmin missing authenticationitsmeravitejak Online-Examination-System
- CVE-2026-111869makeplane API Endpoint reliance on untrusted inputs in a security decisionmakeplane plane
- CVE-2026-111868datastax pulsar-jms PulsarObjectMessage.java decode deserializationdatastax pulsar-jms
- CVE-2026-111997ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % charactersbeaugunderson ip-address · ip-address